Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects instances where a php-fpm process spawns a shell (sh, bash, dash) executing potentially malicious command patterns such as rm -f, sed -i with chained metacharacters, calls to the local CWP user API, or chmod on temporary files.
The following analytic detects additions of federated identity credentials to Entra ID service principals.
It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application" operations and filters on the FederatedIdentityCredentials modifiedProperty.
Workload identity federation allows external OIDC workloads such as GitHub Actions or Kubernetes to authenticate as the SP without a secret.
If an attacker adds a federated credential pointing to a controlled OIDC issuer, they gain a persistent secretless authentication path into the SP that survives credential rotations and is not visible in standard secrets monitoring.
It leverages Azure Active Directory AuditLogs for the "Update service principal" or "Update application" operations and filters on the FederatedIdentityCredentials modifiedProperty.
Workload identity federation allows external OIDC workloads such as GitHub Actions or Kubernetes to authenticate as the SP without a secret.
If an attacker adds a federated credential pointing to a controlled OIDC issuer, they gain a persistent secretless authentication path into the SP that survives credential rotations and is not visible in standard secrets monitoring.
Detects the deletion or movement to deleted items of emails containing security-related keywords such as MFA, sign-in alerts, password resets, or security notifications. This behavior indicates potential anti-forensics or defense evasion tactics by an attacker attempting to hide evidence or buy time.
Detects instances where a user account accesses a development resource and subsequently accesses a production resource from the same source IP address, where that IP address has not been historically used by the user for production access within a defined baseline period.
Detects suspicious chains involving LuaJIT binary execution, dropped dist.lua scripts in temp directories, scheduled task persistence utilizing numbered LuaJIT executables, and specific lure zip file downloads or anomalous script creation in setup directories.
Detects web server processes or spawned shell interpreters executing search tools (like grep, find, cat) against known configuration or shell history files containing credential-related keywords.
This analytic detects Linux processes such as sh, bash, and common Linux LOLBINs being spawned by React or Next.js application servers.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is commonly used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
Public proof-of-concept payloads and observed in-the-wild exploit traffic show patterns where the vulnerable React Server Components handler triggers process.mainModule.require('child_process').execSync() to execute binaries such as ping, curl, or arbitrary shells on the underlying host.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is commonly used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
Public proof-of-concept payloads and observed in-the-wild exploit traffic show patterns where the vulnerable React Server Components handler triggers process.mainModule.require('child_process').execSync() to execute binaries such as ping, curl, or arbitrary shells on the underlying host.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
This correlation analytic identifies likely PHP2Shell exploitation attempts by correlating a PHP memory disclosure indicator
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
with either of two independent PHP web exploitation indicators from Cisco Secure Firewall Threat Defense Intrusion Events.
Seeing these behaviors from the same source against the same destination within a short period can indicate an attempt to
improve the reliability of subsequent exploitation. Investigate the complete network and web server activity.
Correlates inbound delivered emails containing ChatGPT share links (https://chatgpt.com/share/) with subsequent allowed click events by the same recipient on the matching URL.
Identifies vulnerable Node.js versions affected by CVE-2026-111497, classifies software versions by vulnerability status, provides remediation guidance, and retrieves installation path evidence to support investigation and cleanup.
Flags cmd.exe launched by a script host, Office or msiexec whose command line downloads with curl -s -o to a .pdf name and deletes with del /s /q, and involves Users\Public, AppData, conhost or --headless: the PXA Stealer
This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Bulk staging before exfiltration commonly produces large archives written by archiving utilities or PowerShell.
Covers renamed binaries (binary first seen before the range, or the event was not emitted). Matches tool-specific command-line shapes on processes not named like the tool.
Detects Linux process command lines associated with the Mirai l.sh dropper that establish persistence by appending a cron job running /var/.m to /var/spool/cron/root, or by copying and changing permissions of /var/.m within the MTD configuration partition (/mnt/mtd/Config/.m).
Detects credential additions or updates (certificates/secrets) to applications or service principals performed by an application identity (app-only, no user present), where the actor application also performed Microsoft Graph activity prior to the credential change.
Detects Node-RED processes spawning Unix shells to execute base64-decoded commands or downloading and executing hidden payloads via /dev/shm.
Detects an executable launched from a KB-numbered staging folder under AppDataRoaming spawning cmd.exe to execute multiple host and network discovery commands such as registry queries, ipconfig, or tasklist.
Detects shell or downloader child processes (such as sh, bash, cmd.exe, powershell.exe, curl, or wget) spawned by common server application processes (such as Java, Ruby, Perl, or Exiftool), which may indicate Remote Code Execution (RCE) exploitation such as CVE-2021-26084, CVE-2023-22518, or CVE-2021-22205.
Detects correlated activity on Linux devices where system logs are wiped or truncated and security or auditing agents are stopped, disabled, or killed within a one-hour window.
Detects inbound phishing emails delivered via Amazon SES featuring common financial or administrative lure terms (such as invoice, remittance, quarantine) where the embedded URL includes parameters containing the recipient's email address.
Page 13 of 2907